I've been playing with Wifi routers of late, running stock, Tomato, DD-WRT, Merlin.

Something I cannot for the life of me do, is get any of them to do NAT loopback correctly. Specifically, I want accesses to port 80 on the public (internet facing) IP address to be looped back through an established port-forward to an internal web server. And I want that web server to see them as COMING FROM THE INTERNET, not the LAN.

Most of them pretend to do it for LAN clients, but the web server just sees the requests as coming from the LAN IP of the router, not from an external IP (eg. the public IP).

Okay, fine, I can live with that.

But what we really need, is for the "guest WiFi" clients to be able to access that same web server. None of the firmwares do this, and my best attempts thus far at just adding the standard PREROUTING/POSTROUTING rules have no effect whatsoever.

Anyone out there grok this stuff? I certainly don't.